MalwareUsed by 1 actor

MURKYTOP

MURKYTOP is a Windows command-line reconnaissance utility associated with the China-linked espionage actor APT40, also tracked as BRONZE MOHAWK, Leviathan, Temp.Periscope, and related aliases. It is used during post-compromise operations to map victim networks and support lateral movement. Documented functionality includes identifying remote hosts on connected networks, scanning hosts for open ports, enumerating shared resources on remote systems, retrieving information about users on remote hosts, and deleting local files. Its behavior aligns with internal discovery and operator-driven network exploration rather than autonomous propagation. MURKYTOP has been reported as part of a broader APT40 toolset used against government, academic, maritime, defense, transportation, and other strategic sectors, particularly in espionage campaigns aligned with Chinese state interests.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Leviathan

Tools Nanhaishu, Orz, SeDll, Cobalt Strike, GreenCrash, AIRBREAK, BlackCoffee, China Chopper, FUSIONBLAZE, HOMEFRY, MURKYTOP, Metasploit / Meterpreter, ScanBox, Derusbi Trojan, Derusbi, Metasploit

via secureworks threat profilessecureworks.com

MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1053.002AtEvidence1

T1059.003Windows Command ShellEvidence4

The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.

Persistence

1 technique

T1053.002AtEvidence1

Privilege Escalation

1 technique

T1053.002AtEvidence1

Stealth

1 technique

T1070.004File DeletionEvidence8

The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.

Discovery

7 techniques

T1018Remote System DiscoveryEvidence2

During the 2015 Ukraine Electric Power Attack, Sandworm Team remotely discovered systems over LAN connections. OT systems were visible from the IT network as well, giving adversaries the ability to discover operational assets.

T1046Network Service DiscoveryEvidence3

The content repeatedly describes threat actors and malware performing network scanning, port scanning, service enumeration, OS fingerprinting, and identifying open ports/services across victim environments.

T1069Permission Groups DiscoveryEvidence1

T1082System Information DiscoveryEvidence9

The content repeatedly describes malware and threat actors collecting OS version, computer name, architecture, CPU, memory, disk, BIOS, language, and other host details; examples include use of commands such as ver, systeminfo, hostname, uname -m, and WMI to gather host information.

T1087Account DiscoveryEvidence1

“actors used the following commands… to enumerate user accounts: net user >> %temp%\download; net user /domain >> %temp%\download … APT1 used the commands net localgroup, net user, and net group to find accounts… APT32 enumerated administrative users using the commands net localgroup administrators … OilRig has run net user, net user /domain, net group "domain admins" /domain …”

T1087.001Local AccountEvidence1

T1135Network Share DiscoveryEvidence2

APT1 listed connected network shares. APT32 used the net view command to show all shares available, including the administrative shares such as C$ and ADMIN$. APT41 used the net share command as part of network reconnaissance.

ACTIVITY FEED

Recent activity

14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

14 SOURCESView more in app

mitre attack websiteNews

Oct 25, 2022

Network Share Discovery, Technique T1135 - Enterprise | MITRE ATT&CK®

Backdoor malware capable of retrieving information about shares on remote hosts.

mitre attack websiteNews

Oct 21, 2021

Indicator Removal on Host: File Deletion, Sub-technique T1070.004 - Enterprise | MITRE ATT&CK®

Backdoor malware capable of deleting local files.

fireeyeNews

Mar 4, 2019

APT40: Examining a China-Nexus Espionage Actor

Command-line reconnaissance tool that can also support lateral movement activities.

mitre attack websiteNews

Jun 1, 2017

Remote System Discovery, Technique T1018 - Enterprise | MITRE ATT&CK®

A backdoor capable of identifying remote hosts on connected networks.

+9 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

MURKYTOP